WLAN Positioning. Jonas Geistert TU Berlin Germany, Berlin

Transcription

1 WLAN Positioning Jonas Geistert TU Berlin Germany, Berlin Abstract WLAN positioning systems are a promising approach to determine a users location in In-Building environments. The motivation for developing, the possible utilization as well as known issues are discussed. Physical fundamentals and technical aspects of the WLAN technique are explained to examine the positioning potential in detail. Furthermore, an example positioning system is presented and analyzed. To give a comprehensive overview of different realizations for such systems a taxonomy is proposed. I. INTRODUCTION In recent years several localization systems based on Wireless Local Area Network (WLAN) communication techniques have been presented to the public. Due to the fact that most of these systems do not require additional hardware to localize WLAN clients, they can increase the value of an existing WLAN system. The range of possible applications is broad, for example a WLAN positioning system (WPS) could be used by a user to find the nearest emergency exit, the next printer or locate a particular item in a warehouse. Also improving the network infrastructure by enabling location based routing is possible. In the following other utilizations are discussed briefly. An example application could be the navigation through a multi-story car park to a parking spot one reserved in advance, that is the closest to a desired destination or the one where your car is parked. Currently BMW is developing a system for this purpose based on WLAN positioning techniques [1]. Especially for car rental companies where the renter is responsible for parking the vehicle in the companies car park, WLAN positioning is a promising approach to improve the efficiency of the rental period. Further applications are the positioning of valuable equipment and personnel in a hospital. So, equipment could be found easily with the help of a WPS and this could avoid todays practice of providing redundancy for equipment which is difficult to find by different personnel. Another case is that personnel with short distance to an inpatient who wishes contact to the personnel can be advised to visit the inpatient. At an airport or a train station, WLAN based indoor navigation systems could help people to find the next connection. A. Alternative Positioning Techniques For a comprehensive overview, there s a need to look at alternative positioning systems The most popular of these systems is the Global Positioning System (GPS). With the help of a special GPS-Receiver, it is possible to determine a accurate location of a user nearly everywhere on the planet. GPS measures the propagation delay of radio signal transmitted by satellites for position estimation, but due to this it has very limited reception in indoor environments. Another common approach to locate people in emergency cases is achieved by using the cell-phone signals, which is used to call the emergency services [2]. These Global System for Mobile Communications (GSM) techniques use signal attenuation, angel of arrival and time difference of arrival to determine the user location. Despite the fact that signal reception in buildings is still usable for communication, the propagation of these signals is determined by reflection, thus the mentioned location estimation methods are not working as accurate as promised. Same for GSM location in urban areas. Other approaches specially designed for indoor positioning, are for example the Active Badge [3] and Active Bat [4]. Active Badge, one of the first indoor positioning systems, was developed in 1989 by the former Olivetti Research Laboratory. It is using Infra-Red(IR) signals and requires installation of special IR receivers in every room of the observation area. These IR receivers receive signals transmitted by battery powered IR tags and so estimate the position of this tag to room level accuracy. A disadvantage of IR based Positioning systems is the susceptibility of IR signals to direct sun light. The Active Bat system uses ultrasonic signals for position estimation and achieves an accuracy of 9 cm. But as well as Active Badge this system requires special equipment installed in the observation Area. The here mentioned accuracy and its difference between precision is shown in Figure 2. There also exist video location systems [5], which use video recordings to identify and locate equipment and people, these systems require additional hardware (e.g. cameras to provide visual data of the area of interest). Another problem is the conflict with various privacy interests, due to constant observation. Also many cheap and reliable systems for locating equipment as well as people is implemented with the help of Radiofrequency identification (RF-ID) tags, but the position estimation of these passive RF components requires the immediate proximity of a RF-ID scanner and due to that, the active participation of the user, who has to produce the proximity between tag and scanner. B. Technical Overview To understand the principles of WPSs it is necessary to get an idea of how WLAN works. So in this section the basic concepts behind WLAN technology, defined by the IEEE standard , are briefly explained. The main

2 Fig. 1. WLAN signal distribution in a single room [6] Fig. 2. Difference between precision and accuracy [wikipedia] idea behind WLAN systems is to modulate electromagnetic waves to send data over the air. Because different Radio Frequency(RF) signals interfere with each other it is desirable to reduce the number of stations transmitting at the same time on the same frequency. This is achieved by dividing the time and the frequency spectrum. The time is divided into coherent time slots, these slots are called frames, and the bandwidth is divided into channels with a fixed base frequency and a fixed bandwidth. These divisions defined by the IEEE standard make it possible that not only several participants of a network can send data virtually parallel, even the coexistence of several networks in the same physical space is possible. 1) Time Multiplexing: The mentioned time multiplexing method for WLAN is defined as Carrier sense multiple access with collision avoidance (CSMA/CA). This method is implemented in the Media Access Control (MAC) protocol and works after the following scheme. Before any transmission on the media is made the transmitter senses if the carrier is ready for a transmission (i.e. there are some Carrier Sense(CS) mechanism based on medium-use rules). To reduce the probability of collisions just after the medium becomes idle, every transmitter has to wait a random backoff time. This time is called Contention Window(CW) because at this time different transmitters can be in contention for the medium. There is a certain need for a low collision probability because, due to the use of a single wireless medium, a transmitter can not send and receive at the same time. So a collision leads to a disproportional high waste of transmission time, because the transmission will not go down. 2) Modulation: As mentiond above a data which shall be transmitted has to be modulated onto the carrier signal. WLAN technology uses either Frequency Hopping Spread Spectrum (FHSS), Direct-sequence Spread Spectrum (DSSS) or Orthogonal frequency-division multiplexing (OFDM). FHSS is the oldest way for modulating information in a WLAN and nearly deprecated. It switches the carrier frequency rapidly, so the spectrum in enlarged and reflections can not interfere as much as with a single carrier frequency. These frequency switches are implied by a sequence of pseudo random number and due to that predictable to the receiver who have to follow each frequency switch. The second mentioned approach to generate a modulated WLAN signal is by using DSSS. This technique, as its name implies, spreads the spectrum of a signal with the help of a direct sequence of so called chips. From this chipsequence a wave pattern can be generated and this pattern and its inverse are assigned to every bit of the data to send. Its advantage is that the generated wave pattern can be more easy recognized by the receiver and due to that the transmission can take place at a higher frequency. A WLAN with DSSS, uses a chip sequence of the size eleven. The OFDM uses 52 orthogonal carrier frequencies with a pitch of MHz to transmit 48 pieces of the signal and 4 pilot signals at once. This parallel transmission signal is generated by the transmitter and analyzed by the receiver with a Fourier Transformation (i.e a Fast Fourier Transformation and its inverse). The advantages of the OFDM are high data rates and a balanced frequency spectrum. II. MEASURING NETWORK CHARACTERISTICS To determine a position thus WLAN signals, these signals have to be measured. In the following some network characteristics, their spatial dependency and their measurement properties are explained. A. Time Delay Due to finite speed of a radio signal, time measurements are a common approach to determine positions of a receiver or transmitter. For example GPS determines the propagation delay of a signal and from that computes the distance to the transmitting satellite. An important fact to be considered is that radio signals propagate at nearly the speed of light (i.e. it travels nearly 300 meter in a millionth of a second). So to determine the propagation distance form propagation delay to about one meter requires a clock frequency of about 300 MHz. This resolution in time is not given by current WLAN equipment but as shown in [7] and [8] it can be achieved by combining and smoothening several measurements. Another fact is that WLAN signal propagation in buildings is affected by reflection, so the fastest signal is not necessarily the one with the direct path between sender and receiver. Another disadvantage for time delay bases positioning systems as

3 proposed in [9] is that a client need to change the actual access point for every time delay measurement, because a reconnection takes some time and the encryption key for every network has to be known. B. Angle of Arrival The Angle of Arrival(AoA) of a radio signal can be determined either with mechanically actuated directional antennas or an multiple antenna array. An example for directional antennas are parabolic antennas used for satellite television. Directional antennas are not common in off-theshelf indoor communication systems, but antenna arrays are gaining popularity together with the Multiple Input Multiple Output(MIMO) techniques. From a multiple antenna arrays the AoA can be derived by evaluating the phase shift measurements of each antenna. Figure 3 shows a simplified simulation for the reception of different phases for three different angles for an antenna array composed of 2 antennas. The colored dots at the bottom of Figure 3 represent the phase which could be measured at the antenna above the dot. The signal for the array at the left is arriving with a zero degree shift, so both antennas receive the same phase (i.e. the dots bellow are both black). For the array in the middle the signal is arriving with a 30 degree shift and the array at the right is receiving a signal with 60 degree shift, so the color differences, of the dots representing the received phase,in the middle represent a received phase shift of nearly half a wave length and the color differences in the right part a phase shift of about three quarter wave length. Estimating the AoA with the help of antenna arrays is not part of the current IEEE standard, but can improve existing WLAN positioning systems as shown in [10] or possibly be the basis for new positioning techniques [11]. C. Signal Attenuation Signal attenuation is the physical phenomena which describes the intensity loss of an electromagnetic wave. So signal attenuation can not be measured directly at a given location. The intensity of an electromagnetic wave is defined as the power density multiplied with the speed of the energy movement. Due to the physical properties of electromagnetic waves the propagation is affected by different physical effects such as reflection,refraction and absorption. Figure 1, taken from [6], shows a typical WLAN signal intensity map of a square office room with an open doorway at the top right corner and a standard metal desk in the bottom left corner. The intensity is expressed by the color, the same way usually temperatures are displayed, where a more hot color means greater signal strength. The differences in signal strength shown are about 50 db. So neither the signal attenuation nor the signal intensity can be measured directly. But possible is a measurement of the energy received at an antenna during signal reception. This information is valuable for a WLAN because due to that for example the transmitting power can be adjusted and reception quality can be evaluated. The IEEE standard provides that this measurement is done optionally and outputted as the Received Signal Strength Indicator (RSSI). TABLE I PERFORMANCE DIFFERENCES FOR DIFFERENT NETWORK CHARACTERISTICS Network Characteristics median error distance Signal Strength 7.75m Signal Noise Ratio 7.44m Noise 11.8m Signal Strength and SNR 7.24m As defined by IEEE standard the RSSI is given by a integer, and intended to be used in a relative manner. This lack of specified accuracy leads to many different implementations by different WLAN equipment vendors [12]. Usually the WLAN interface software outputs an RSS value given in dbm derived from the RSSI. Another important information for signal processing in condition to signal attenuation is the Signalto-Noise ratio (SNR). This measure quantifies how much a signal is affected by noise. Like for the RSSI there is no definition with absolute accuracy in the IEEE So most likely there exist several different implementations for the SNR estimation and even WLAN interfaces that do not support SNR estimation. Another measurable information with influences on the signal attenuation is the noise level on the wireless channel. The last three mentioned parameters have been examined for their spatial dependency (e.g. how much information about the position can be derived from the parameter) in [13]. The results of this examination are presented in Table I. Remarkable is, contrary to assumptions made in [14] and [15], the fact that the positioning through SNR can deliver nearly as accurate results as through RSS and the combination of both leads to even better accuracy. III. GENERAL CATEGORIZATION OF POSITIONING METHODS Most positioning methods can be categorized into one of the following schemes: Network-based, Terminal-based and Terminal-assisted. A positioning method is Network-based if all the measurements and calculations are done by the network infrastructure. Therefore the network infrastructure (e.g. the base stations) need the capability to measure the characteristics and somehow the estimation of the position must be done, this is possible for a WLAN infrastructure, but generally not implemented in common WLAN base stations. An advantage of this method is that the mobile client can be kept very simple, there is no need for measurements and estimations on client side. An often criticized problem of these methods is that the clients position can be estimated without permission of the client. Contrary to that, Terminal-based and Terminal-assisted methods measure the signal characteristics on the client side and in case of a Terminal-based method even position estimation is done on client side, in case of a Terminal-assisted method the measurements are send to a location-estimation-server, which determines the position of the client.

4 IV. BASIC POSITIONING APPROACHES The two well examined positioning approaches based on WLAN technology, Cell of Origin (CoO) and Strongest Base Station (SBS) are shortly described bellow. The Cell of Origin method assumes that the position of a client is equal with the position of the Base Station(BS) to which the client is currently connected. Contrary to that, the SBS method uses information about all receivable BSs and determines the position of the user to the position of the BS with the strongest RSSI. Ideally the user is connected to the BS with the strongest RSSI, so in this case both methods would deliver the same result. Both methods are limited in accuracy by the fact that the reception area of a BS in buildings, usually has a radius between 25 and 50 meters[15]. Another limitation of both methods is the needed knowledge of the BS position. V. RADIO FREQUENCY LOCATION FINGERPRINTING A Radio Frequency Location Fingerprint (RF-LF) is a pattern of several recorded radio frequency signal characteristics which can be assigned to a spatial location. A Location Fingerprinting System (LFS) aims to determine the position of a measured RF-LF. From literature a LFS can be divided in two phases an off-line phase and an on-line phase. In the off-line phase the RF-LFs are collected (e.g. a radio map is created). In the on-line phase, a RF-LF determined by the target is compared with the values in the radio map by a position estimation algorithm which then estimates the targets position. There are different possible design principles for the on-line as well as the off-line phase. In the off-line phase there are two ways for creating the radio map, an empirical and a model based. The empirical way is to do measurements in the observation area to fill the radio map. For a model based radio map the reference RF-LFs are calculated for each reference point on the radio map. A disadvantage of the first is that for precise positioning results the measurements have to be repeated for every changes that affect the signal propagation, for example access point reconfiguration, movement of an access point and as proposed in [16] even for a different number of people in the observation area. A disadvantage of the model driven method is that due to complexity of radio wave propagation the model gets also very complicated and is usually not as accurate as measurements. The differences in the on-line phase can be summarized to deterministic and probabilistic approaches. A deterministic LFS solves the positioning problem by interpreting the measurements only by their value while a probabilistic LFS determines the position interpreting the measurements as part of a random process. Another division for LFS can be made for point and area based LFS. The difference here is that while a point based LFS outputs the position to a certain point area based LFS estimating the position within a certain area, so area based systems can trade accuracy for precission [17] [18]. A. LFS Taxonomy The location fingerprinting taxonomy proposed in [19] is constructed from a literature study of 51 papers and articles Taxon Scale Output Measurements Roles Estimation Method Radio Map Spatial Variations Temporal Variatons Sensor Variations Collector Collection Method TABLE II DIFFERENT TAXONS PROPOSED IN [19] short description Size of deployment area. What location information is generated Which network characteristicas are measured Who measures the network characteristicas and how determes the actual position Function to derive position from currently measured signal how is the reference data created and evaluated aswell as how much reference data is available How are spatial variations handeld in the system How are time dependent variations handeld How are variations in measerments due to different measerment hardware handeld Who or what collects fingerprints How are fingerprints collected about 30 different LFS implementations. It is applicable for LFSs based on WLAN as well as GSM technology and with different sizes the deployment area (e.g. LFSs suitable for inbuilding to city-wide use). This taxonomy gives an overview of realization possibilities for an LFS which can help further developments of these systems and especially researchers investigating these systems. All taxons and a short description are presented in Table II. Also an example distribution of the examined systems for the radio map taxon is shown bellow. The radio map taxon allows the division into empirical and model-based and from all 30 systems 27 use an empirical and 7 a model-based radio map, so obviously four systems use both kinds of radio map and only three are not using an empirical radio map. B. Estimator In general the Estimator is responsible for transforming the measurement results into a spatial position. A brief summary of different possibilities for an Estimator is given here. As mentioned an estimation method can be either probabilistic or deterministic. Further it can use additional information for example building plans, to avoid that a position is estimated to a location which can not be reached by the user (e.g. inside a wall or outside the building) or information about user motion patterns. The Estimator also decides how to handle consecutive measurement results with small temporal distance and an estimated spatial distance, which is impossible to travel for a client in that time. VI. THE RADAR SYSTEM The RADAR system[14] is the first approach to determine a location with a high degree of accuracy from information received through a wireless network interface. For this study a network device called WaveLAN [20], a compatible device, is used to examine the potential of tracking users in the hallway of one floor in an office building with the dimensions of 25.5 times 43.5 meters.

5 Fig. 3. Visualized AoA estimation for three different angles the RSS records are more valuable. B. Model Based Radio Map The authors considered three different models for creating a model based radio map, the Rayleigh fading model, the Rician distribution model and the Floor Attenuation Factor propagation Model (FAF). They chose the FAF, because it is the one with the best compromise between simplicity and accuracy. The FAF, as proposed by Seidel and Rapaport [21], originally developed to estimate signal propagation affected by large-scale path loss over several floors. One main characteristic of this model is that for many floors between sender and receiver the the path loss is nearly identical with the free space path loss. For the RADAR system a modified version of this model is introduced, the Wall Attenuation Factor model (WAF), which can be described by P (d)[dbm] = D(d)[dBm] F (n) (1) where D(d) is the predicted signal strength in condition to the distance d and F is the attenuation conditioned by the number of walls in direct line between sender and receiver n. D(d) is calculated from a reference signal strength measurement P (d 0 ) at a reference distance d 0 with the formula: Fig. 4. Signal Propagation estimated by the WAF Model [14] A. Off-line phase The authors proposed a way for creating an empirical radio map and motivated by the desire to be independent of the empirical data collection, a model based radio map was created. In the following both ways are presented. 1) Empirical Radio Map: The authors installed three base stations (BS) so that the whole floor is covered with at-least one and possibly three usable wireless signals. Afterwards they setup a data collection system on each of the three BSs for collecting RSS and SNR values for each received broadcast packet. These information are stored in a vector together with a synchronized time-stamp. The above mentioned broadcast packets have been transmitted at a default rate of four packets per second by a laptop also equipped with a WaveLAN adapter moving through the hallway of the floor. While transmitting the packets, also the synchronized time-stamp and additionally the current position including the orientation of the mobile client have been stored. This procedure was performed to produce and collect at least 20 reference signals for 70 different reference locations and per location four orthogonal orientations. At the end of the off-line phase, all data is merged into a single table with entries containing a 2D coordinate of the location, a direction, three SNR values and three RSS values, regarding each to one of the three base stations. This merging operation was achieved with the help of the synchronized time-stamp. Noticeable is that the utilization of the SNR values is not investigated by the authors, founded by the assumption that ( ) d D(d)[dbm] = P (d 0 )[dbm] 10 r log d 0 where r indicates the rate for the general path loss. The subtrahend F is defined as the product of the number of walls n and the empirical determined, environment specific Wall Attenuation Factor. Nevertheless F is limited by a constant C which is the maximum number of walls the model should take into account. So F can be expressed as : { n W AF [dbm] if n < C F (n) = (3) C W AF [dbm] if n C For this purpose the following values where derived empirically from measurements made for determination of the empirical radio map. The W AF is determined to 3.1 dbm, C to 4, P (d 0 ) with d0 = 1m to dbm and r to Figure 4 shows the results of the applied model in comparison with the empirically determined values for each of the 70 locations. C. On-line phase For deriving the position of the mobile client two different estimation methods are proposed. 1) Nearest Neighbor(s) in Signal Space: The Nearest Neighbor(s) in Signal Space (NNSS) algorithm estimates the location of a measured triplet of signal strength values (e.g. a RF-LF) to the location of a reference point through a simple comparison with the reference values in the radio map. The comparison between the fingerprints is done by calculating the euclidean distance, as shown in (4) where r i is the reference (2)

6 TABLE III ESTIMATION RESULTS FROM NNSS ALGORITHM WITH EMPIRICAL AND THEORETICAL DERIVED REFERENCE DATA COMPARED WITH THE SBS METHOD AND THE MNN METHOD FOR error distance for 25th percentile 50th percentile 75th percentile NNSS: empirical 1.92m 2.94m 4.69m NNSS: model based 1.86m 4.3m - MNN k=5 1.5m 2.75m - MNN k=1 * 1.8m 2.67m - MNN k=4 * 1m 2.3m - SBS 4.54m 8.16m 11.5m mesurament and m i is the actual measurement for the i th base station. D = (r 1 m 1 ) 2 + (r 2 m 2 ) 2 + (r 3 m 3 ) 2 (4) 2) Multiple Nearest Neighbors: The other proposed estimation algorithm is called Multiple Nearest Neighbors (MMN). It uses the NNSS algorithm to determine the k nearest neighbors to averaging the physical location in between these k nearest neighbors. This method could provide a more accurate location because the error distance in physical space for positions determined by NNSS have most likely a different direction, so that the combination of these directions can correct the real position. Also the NNSS algorithm does not consider valuable information about neighbors with a small distance in signal space to the nearest neighbor. The experimental analysis of the MNN estimator with the records containing locations and orientations as distinct positions, showed that averaging with for instance five neighbors brings some, non significant benefit. The explanation for this is that the empirical derived radio map contains for every physical reference position four RF-LFs and most likely these four entries are close in the signal space. Due to this effect, for the examination of the MNN method the information about the clients orientation was rejected. The assumption made here is that the mobile host is not obstructed by the user body. So instead of using four RF-LFs for each physical location only one computed RF-LF is used for further analysis. The computation of this RF-LF is done by picking the highest average value for each BS among the four orientated RF-LF. D. Results of the experimental Analysis The results of the experimental analysis are summarized in Table III. The first and second entry are representing the results derived by NNSS with the empirical and the model based radio map. The third entry presents the results for the MNN for k=5 applied to the empirical radio map. Entry four and five of the table presenting results for the MNN for k=1 and k=4, but applied to the new radio map containing only the computed RF-LFs. For comparison the last row shows results estimated with the SBS method. VII. HYPERBOLIC LOCATION FINGERPRINTING As mentioned above the RSS measurements from different WLAN interfaces can differ significantly. For example, when using a radio map constructed within the RADAR system and determining the RF-LF of the current position with different WLAN hardware, these measurement differences would possibly lead to greater error distances as proposed in the RADAR paper. A solution to avoid the creation of several radio maps for different WLAN interfaces is proposed in [12] as Hyperbolic Location Fingerprinting (HLF). The presented solution, is not using absolute RSS values in the radio map nor the estimation algorithm, instead it uses RSS ratios between pairs of base stations. Remarkable is that this method leads to an accuracy and precision that is nearly as high as if equal hardware for on and off-line phase would have been used. VIII. KNOWN PROBLEMS In this section some problems for using different WLAN positioning systems (WPS) are discused. A. Privacy Law Several WPS with deployment areas bigger than a single building often use information about access points not owned by the provider of the system. These information have to be collected in some way, in this process often the BSSID and the SSID of the network are stored. The BSSID is a worldwide unique number assigned by the manufacturer of the base staion and the SSID is the name of the network chosen by the owner of the network. Collecting both of them can improve the localization process for several reasons, for example if a changed SSID with changed BSSID is found in the on-line phase this could be an indication for changed spatial location of the BS or if a known SSID with unknown BSSID is recorded in the on-line phase it can be considered to use the position of the BS with the same SSID in the estimation process. But it is not clear whether the SSID of a wireless access point can be considered as private data, because it can contain for example the name or telephone number of the owner. This fact could be a problem because it would violate privacy law. Nevertheless, a WPS could avoid this problem by only collecting information about the BSSID which is sufficient in most cases. B. Manipulation In general wireless communication is susceptible to manipulation, because the medium which is used for signal transmission can be easily accessed by third. So a there existing several kinds of jamming attacks, where the wireless channel is jammed by the attacker and as a result the wireless system becomes unusable. Some of them require special hardware, some can be performed with an ordinary laptop equipped with a WLAN interface. As shown in [22] these jamming attacks can also interfere WLAN positioning systems. The authors also proposed methods for manipulating the results of a WPS, for example by eliminating signals from legitimate access points and sending signals from an impersonated access point. These attacks can be performed on any WPS where the attacker has the possibility to come close enough to the target. Another kind of attack proposed in [22], suitable for a WPS using a location fingerprinting database where the users

7 can contribute measured fingerprints, manipulates the results by inserting false data in the database. From this it follows that, WLAN positioning systems without appropriate security mechanism should not be used in any security or safety critical applications. IX. CONCLUSION This paper presents and discusses several issues concerning current and coming WLAN positioning techniques in general as well as the details of these systems. REFERENCES [1] BMW Pathfinder, Navigation 3.0. [Online]. Available: html [2] S. Wang, M. Green, and M. Malkawa, E-911 location standards and location commercial services, in Emerging Technologies Symposium: Broadband, Wireless Internet Access, 2000 IEEE, 2000, p. 5 pp. [3] R. Want, The Active Badge Location System, ACM Trans. Information Systems, pp , [4] A. Laboratories, Active Bat System. [Online]. Available: [5] J. Krumm, S. Harris, B. Meyers, B. Brumitt, M. Hale, and S. Shafer, Multi-Camera Multi-Person Tracking for EasyLiving, Visual Surveillance, IEEE Workshop on, vol. 0, p. 3, [6] IEEE Standard for Information technology-telecommunications and information exchange between systems-local and metropolitan area networks-specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications, IEEE Std (Revision of IEEE Std ), pp. C1 1184, [7] P. Uthansakul and M. Uthansakul, WLAN positioning technique based on measured time delay distribution, in Communications, APCC th Asia-Pacific Conference on, oct. 2008, pp [8] A. Günther and C. Hoene, Measuring Round Trip Times to Determine the Distance between WLAN Nodes, Technical Report TKN-04-16,TU Berlin, Dezember [9] M. Llombart, M. Ciurana, and F. Barcelo-Arroyo, On the scalability of a novel wlan positioning system based on time of arrival measurements, in Positioning, Navigation and Communication, WPNC th Workshop on, march 2008, pp [10] M. Roshanaei and M. Maleki, Dynamic-KNN: A novel locating method in WLAN based on Angle of Arrival, in Industrial Electronics Applications, ISIEA IEEE Symposium on, vol. 2, oct. 2009, pp [11] C. Wong, R. Klukas, and G. Messier, Using WLAN Infrastructure for Angle-of-Arrival Indoor User Location, in Vehicular Technology Conference, VTC 2008-Fall. IEEE 68th, sept. 2008, pp [12] M. B. Kjærgaard and C. V. Munk, Hyperbolic Location Fingerprinting: A Calibration-Free Solution for Handling Differences in Signal Strength, in Proceedings of the Sixth Annual IEEE International Conference on Pervasive Computing and Communications (PerCom 2008). IEEE Computer Society, 2008, pp [Online]. Available: [13] M. Borenovic and A. Neskovic, Comparative analysis of RSSI, SNR and Noise level parameters applicability for WLAN positioning purposes, in EUROCON 2009, EUROCON 09. IEEE, may 2009, pp [14] P. Bahl and V. N. Padmanabhan, Radar: an in-building rf-based user location and tracking system, Proceedings IEEE INFOCOM 2000 Conference on Computer Communications Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies Cat No00CH37064, vol. 2, no. c, pp , [Online]. Available: [15] S. Müller, Positionierung im WLAN, [16] M. Kranz, C. Fischer, and A. Schmidt, A comparative study of dect and wlan signals for indoor localization, in Pervasive Computing and Communications (PerCom), 2010 IEEE International Conference on, april , pp [17] V. Patmanathan, Area Localization using WLAN, Master of Science Thesis, Stockholm, Sweden, [18] E. Elnahrawy, X. Li, and R. P. Martin, Using Area-based Presentation and Metrics for Localization Systems in Wireless LANs, Department of Computer Science, Rutgers University. [19] M. B. Kjærgaard, A taxonomy for radio location fingerprinting, in Proceedings of the 3rd international conference on Location-and context-awareness, ser. LoCA 07. Berlin, Heidelberg: Springer-Verlag, 2007, pp [Online]. Available: [20] Digital RoamAbout 915/2400 DS/PC Card and ISA Network Adapter: Installation and Configuration, DEC, April [21] S. Seidel and T. Rappaport, 914 MHz path loss prediction models for indoor wireless communications in multifloored buildings, Antennas and Propagation, IEEE Transactions on, vol. 40, no. 2, pp , feb [22] N. O. Tippenhauer, K. B. Rasmussen, C. Pöpper, and S. Čapkun, Attacks on public WLAN-based positioning systems, in Proceedings of the 7th international conference on Mobile systems, applications, and services, ser. MobiSys 09. New York, NY, USA: ACM, 2009, pp [Online]. Available: